CVE-2026-15384
Received Received - Intake

Manual Image Crop WordPress Plugin Authenticated Image Overwrite

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: WPScan

Description
The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in user. A subscriber-level user can therefore supply an arbitrary attachment ID and overwrite that attachment's generated intermediate-size image (for example its thumbnail) and mutate its stored metadata, regardless of who owns the media. This is a cross-user integrity/defacement issue over the Media Library. The action also has no nonce, so it is additionally susceptible to CSRF.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-15384
EUVD
EUVD-2026-59910

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
manual_image_crop manual_image_crop to 1.15 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the WordPress plugin 'Manual Image Crop' before version 1.15. It allows any logged-in user, even with basic subscriber access, to overwrite image files and metadata in the Media Library without proper authorization checks. The plugin fails to verify user permissions or use security tokens (nonces) for an AJAX action that crops images, enabling unauthorized modifications.

Detection Guidance

Check if the Manual Image Crop plugin is installed and its version is below 1.15. Inspect WordPress logs for unauthorized AJAX requests to cropping actions or unusual metadata changes in the media library.

Impact Analysis

An attacker with subscriber-level access could deface your website by altering images or their thumbnails. They might replace legitimate images with malicious content, change metadata, or disrupt site functionality. The lack of CSRF protection also allows attackers to trick users into triggering the vulnerability without their knowledge.

Compliance Impact

This vulnerability could lead to unauthorized modifications of media files, potentially violating integrity requirements under GDPR (data accuracy) or HIPAA (integrity of protected health information). If user-uploaded images are altered without consent, it may constitute a breach of compliance obligations for data protection and integrity.

Mitigation Strategies

Update the Manual Image Crop plugin to version 1.15 or later immediately. If updating is not possible, consider disabling the plugin until an update is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15384. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart